Personal data shall be deleted following the termination of the...

Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, being their storage authorized for the following purposes:
I – compliance with a legal or regulatory obligation by the controller;
II – study by a research entity, ensuring, whenever possible, the anonymization of the personal data;
III – transfer to third parties, provided that the requirements for data processing as provided in this Law are obeyed; or
IV – exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.